The NJCCIC observed an increase in phishing campaigns impersonating copyright infringement notices for media shared on the Meta platform. The notices appear to be sent by Meta or its legal counsel and threaten action, such as account deletion, if the media is not removed or a response is not provided immediately. These emails use subject lines such as:

• Meta requires authentication to ensure continuous account availability
• Your account will be permanently disabled if this issue is not resolved – Case No: 573444265
• Violation of Trademark Rights – Case No. 61825027
• Decision to permanently disable your account due to Trademark Rights violations (Violation Number: 954869856)
• Improper Use of Protected Audio in Media Content

The message contains a link to a Netlify, “Pages.dev”, or Google Sites page that displays a fabricated infringement notice and redirects users to a counterfeit Meta authentication page. This fake login page is designed to steal Meta credentials and personally identifiable information (PII) and then transfer them via SmtpJS to the threat actors behind these campaigns.

Recommendations

• Avoid clicking links and opening attachments in unsolicited emails.
• Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
• Maintain robust and up-to-date endpoint detection tools on every endpoint.
• If you suspect an account has been compromised, change the account’s password immediately and add MFA.
• If sensitive information was entered, change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources, including credit freezes.
• Review the Don’t Take the Bait! Phishing and Other Social Engineering Attacks NJCCIC product for more information on common phishing and social engineering attacks.
• Report malicious cyber activity to the NJCCIC and the FBI’s IC3.